CVE-2026-77116

MediumCVSS 4.3/10Last modified Oct 12, 2026

Description

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
UnknownBrave< 0.8.6

References

Timeline

Published
Aug 23, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-771175.9Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library versiCVE-2026-771188.4A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop aCVE-2026-771195.9A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a CVE-2026-77126.3A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. ThCVE-2026-771208.7CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause priCVE-2026-771216.5A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata fieCVE-2026-771224.3An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus RepCVE-2026-771236.5Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabiCVE-2026-771247.2In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether sCVE-2026-771257.1A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly eCVE-2026-771276.0The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenCVE-2026-771286.3The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-o
CVE-2026-77116: Medium severity, CVSS 4.3 | Vulnix